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© Failure detection in a redundant duplex system. 



If) 



© A failure detection system detects a failure of a package in a redundant system having a duplex package 
configuration. The failure detection system includes a first package (P01 , P11) including a signal processor (150) 
for carrying out a predetermined signal processing on an input signal to the first package, where the first 
package is provided in each of first and second systems, a second package (P02, P12) including a selector 
(100) for selectively outputting an output signal of the signal processor of the first package in one of the first and 
second systems in response to a control signal, a failure detector (300) for detecting a failure in the output signal 
of the signal processor of the first package in each of the first and second systems and for outputting a failure 
detection signal if the failure is detected, and a signal processor (200) for carrying out a predetermined signal 
processing on the output signal of the selector, where the second package is provided in each of first and 
second systems, and a controller (900) for supplying the control signal to the selector of the second package in 
each of the first and second systems based on the failure detection signal received from the second package in 
each of the first and second systems, so that the selector selectively outputs the output signal of the signal 
processor of the first package in an active one of the first and second systems. The controller includes a 
mechanism for disregarding the failure detection signal received from the second package during a predeter- 
mined time in response to a predetermined signal. This predetermined signal may indicate which one of the first 
and second systems is active or, indicate whether or not the second package of each of the first and second 
systems is mounted on a unit to which the first package of each of the first and second systems is mounted. 
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BACKGROUND OF THE INVENTION 

The present invention generally relates to failure detection systems, and more particularly to a failure 
detection system for detecting a failure of a package in a redundant system having a duplex package 
5 configuration. 

In systems such as a communication processing unit which must operate continuously without 
interruption, the continuous operation of the system is guaranteed by employing a duplex package 
configuration and automatically selecting the package in the active (or operating) system. In such a system, 
it is desirable to enable replacement of the package without stopping the operation of the system and 
w without affecting the operation of the system. 

Therefore, there is a demand to realize a failure detection system which enables replacement of the 
inactive (or standby) package during system operation, that is, in the state where the power source is 
turned ON, without affecting the operation of the system. 

FIG.1 shows an example of a conventional failure detection system, and FIG.2 shows the circuit 
w construction of a switch processing part shown in FIG.1. 

In FIG.1, an output signal of a circuit (not shown) which is carried on a system-0 package BO is 
branched and applied to a first input terminal of each of selectors 1 and 7 which are carried on respective 
packages CO and C1 . The packages CO and C1 are provided in a stage subsequent to the stage in which 
the packages BO and B1 are provided. Similarly, an output signal of a circuit (not shown) which is carried on 
20 the system-1 package B1 is branched and applied to a second input terminal of each of the selectors 1 and 
7 which are carried on the respective packages CO and C1 . 

In the package CO, the output signals of the packages BO and B1 which are input to the selector 1 are 
respectively branched and applied to alarm detectors 3 and 4. The alarm detectors 3 and 4 monitor the 
respective input signals and output alarms A1 and A2 to a switch processing part 9 if a failure is detected. 
25 Similarly, in the package C1, the output signals of the packages BO and B1 which are input to the 
selector 7 are respectively branched and applied to alarm detectors 5 and 6. The alarm detectors 5 and 6 
monitor the respective input signals and output alarms A3 and A4 to the switch processing part 9 if a failure 
is detected. 

The switch processing part 9 outputs selection signals for switching the selectors 1 and 7 based on the 
30 alarms A1 and A2 from the package CO and the alarms A3 and A4 from the package C1 , and depending on 
the state of the alarms as shown in Table 1. The selectors 1 and 7 respectively output the input signals 
from one of the packages BO and B1 in response to the respective selection signals. 

Table 1 
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X 
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System-0 



In Table 1 above, "O" indicates the normal state where no alarm is generated, and "X" indicates the 
state where the alarm is generated. A description will not be given of the cases where the alarm is or is not 
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generated, by referring to FIG. 2 which shows the circuit construction of the switch processing part 9. 

In FIG. 2, in the normal state where none of the alarms A1 through A4 are generated as indicated by (1) 
in Table 1 , for example, a signal "0" indicating the normal state is converted into a signal "1 " via inverters 
20, 21 and 23 and is applied to an AND circuit 24. Since all of the four input signals of the AND circuit 24 

5 are "1 ", a signal "1 " is output from the AND circuit 24. The signal "1 " from the AND circuit 24 is applied to 
a terminal a of a selector 33 via an OR circuit 31. On the other hand, because output signals of AND circuits 
27 and 30 are both "0", a signal "0" is applied to a terminal b of the selector 33 via an OR circuit 32. 

Table 2 shows the relationship of the input signals and the output signal of the selector 33. In the above 
described case, the signals "1" and "0" are respectively applied to the terminals a and b of the selector 33. 

w Hence, as may be seen from Table 2, the selector 33 selects and outputs the signal from an input terminal 
T2 and applies this signal to a terminal D of a flip-flop circuit 34. The flip-flop circuit 34 outputs this 
incoming signal from the terminal D from an output terminal Q in response to a clock which is applied to a 
terminal C. The output signal of the flip-flop circuit 34 from the terminal Q is applied to the selectors 1 and 
7 shown in FIG.1 as the selection signals. In this case, the switch processing part 9 feeds back the signal 

w from the terminal Q of the flip-flop circuit 34 to the input terminal T2 of the selector 33, so that the signal is 
output again via the selector 33 and the flip-flop circuit 34. Hence, as indicated by (1) in Table 1, the state 
of the immediately previous system is selected. 



Table 2 

20 



Terminal a 


Terminal b 


Selection State 


"0" 


"0" 


Select "0"-input 


"0" 




Select T1 -input 


"1" 


"0" 


Select T2-input 


"1" 


"1" 





On the other hand, in the case where all of the alarms A1 through A4 are generated as indicated by (2) 
in Table 1, a signal "1" which indicates the generation of the alarm is inverted into a signal "0" before 
being applied to each of AND circuits 1 1 , 13, 15, 17, 19, 24, 27 and 30 shown in FIG. 2. Hence, a signal "0" 
is applied to both the terminals a and b of the selector 33. From Table 2, when the signal "0" is applied to 
both the terminals a and b of the selector 33, the selector 33 selects the "0"-input and applies this signal 
"0" to the terminal D of the flip-flop circuit 34. 

The signal "0" applied to the terminal D is output from the terminal Q of the flip-flop circuit 34 
responsive to the clock which is applied to the terminal C. The output signal of the flip-flop circuit 34 from 
the terminal Q is applied to the selectors 1 and 7 shown in FIG.1 as the selection signals. As a result, the 
selectors 1 and 7 select the system-0, that is, select and output the input signal from the package B0 to a 
processor 2 of the package CO. 

In cases where the alarms A1 through A4 assume states other than those described above, the 
immediately previous system, the system-0 or the system-1, is selected depending on the states of the 
alarms A1 through A4 shown in Table 1 . 

For example, when the output signal of the package B0 is branched and input to the alarm detectors 3 
and 5 of the packages CO and C1, a failure may be detected in one of the alarm detectors 3 and 5 but not 
in the other. Such a case is indicated by a symbol " — " in Table 1 under the column "State of Selection". 
Such a case normally does not occur, but the immediately previous system may be selected if it does 
occur. Here, the "immediately previous system" refers to the package which is of the same system-0 or 
system-1 to which a certain package belongs but is located at a stage immediately preceding the certain 
package. 

Conventionally, the switching of the packages was made in response to the failure detection in the 
above described manner. 

However, according to the conventional failure detection system, the switch processing part 9 carries 
out a switching process when a failure is detected in the active package, regardless of which package is 
active and which package is inactive. In other words, if it is assumed for the sake of convenience that the 
packages B0 and CO of the system-0 are active in FIG.1, a failure of the package B0 may be erroneously 
detected in the package C1 when the package C1 is disconnected or connected for replacement purposes. 
However, the switch processing part 9 in this case has no means of determining whether or not the alarm 
A3 from the package C1 is generated in error. As a result, the switch processing part 9 controls the 
selectors 1 and 7 of the packages CO and C1 so as to select the system-1 in response to the alarm A3. 
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Therefore, although the package BO of the system-0 is operating normally in this case, a switching is 
made by the switch processing part 9. Consequently, there is a problem in that the active package and the 
operation of the active package are affected when the inactive package is disconnected or connected for 
replacement purposes. 

5 

SUMMARY OF THE INVENTION 

Accordingly, it is a general object of the present invention to provide a novel and useful failure detection 
system in which the problems described above are eliminated. 

w Another and more specific object of the present invention is to provide a failure detection system for 
detecting a failure of a package in a redundant system having a duplex package configuration, comprising a 
first package including a signal processor for carrying out a predetermined signal processing on an input 
signal to the first package and for outputting an output signal, where the first package is provided in each of 
first and second systems, a second package including a selector for selectively outputting the output signal 

15 of the signal processor of the first package in one of the first and second systems in response to a control 
signal, a failure detector for detecting a failure in the output signal of the signal processor of the first 
package in each of the first and second systems and for outputting a failure detection signal if the failure is 
detected, and a signal processor for carrying out a predetermined signal processing on the output signal of 
the selector, where the second package is provided in each of first and second systems, and control 

20 means, coupled to at least the second package of each of the first and second systems, for supplying the 
control signal to the selector of the second package in each of the first and second systems based on the 
failure detection signal received from the second package in each of the first and second systems, so that 
the selector selectively outputs the output signal of the signal processor of the first package in an active 
one of the first and second systems, where the control means includes means for disregarding the failure 

25 detection signal received from the second package during a predetermined time in response to a 
predetermined signal. According to the failure detection system of the present invention, it is possible to 
replace an inactive package during operation of the system without affecting the system operation. 

Still another object of the present invention is to provide the failure detection system described above 
wherein the predetermined signal indicates which one of the first and second systems is active. 

30 A further object of the present invention is to provide the failure detection system described first 
wherein the predetermined signal indicates whether or not the second package of each of the first and 
second systems is mounted on a unit to which the first package of each of the first and second systems is 
mounted. 

Other objects and further features of the present invention will be apparent from the following detailed 
35 description when read in conjunction with the accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG.1 is a system block diagram showing an example of a conventional failure detection system; 
40 FIG.2 is a circuit diagram showing the circuit construction of a switch processing part shown in FIG.1; 
FIG.3 is a system block diagram for explaining one aspect of the present invention; 
FIG. 4 is a system block diagram for explaining another aspect of the present invention; 
FIG. 5 is a system block diagram showing a first embodiment of a failure detection system according to 
the present invention; 

45 FIG. 6 is a system block diagram showing an embodiment of the circuit construction of a switch 
processing part shown in FIG. 5; 

FIG. 7 is a system block diagram showing a second embodiment of the failure detection system 
according to the present invention; and 

FIG.8 is a diagram for explaining the operation of a switch processing part shown in FIG.7. 

50 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

First, a description will be given of two basic aspects of the present invention, by referring to FIGS .3 
and 4. FIG.3 is a system block diagram for explaining a first aspect of the present invention, and FIG. 4 is a 
55 system block diagram for explaining a second aspect of the present invention. 

In FIG.3, a failure detection system includes first and second packages P01 and P02 of the system-0, 
first and second packages P11 and P12 of the system-1, and a control part 900. A signal processor 150 for 
carrying out a predetermined signal processing is provided in each of the first packages P01 and P11. A 
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selector 100, a signal processor 200 and a failure detector 300 are provided in each of the second 
packages P02 and P12. 

An output signal of the signal processor 150 of the first package P01 is branched and supplied to the 
selectors 100 and the failure detectors 300 of the second packages P02 and P12, and an output signal of 
5 the signal processor 150 of the first package P11 is is branched and supplied to the selectors 100 and the 
failure detectors 300 of the second packages P02 and P12. The selector 100 selects and outputs the output 
signal from one of the first packages P01 and P11, and the signal processor 200 carries out a 
predetermined signal processing on the output signal of the selector 100. 

The controller 900 receives failure detection signals from the failure detectors 300 of the second 
w packages P02 and P12, and outputs control signals to the selectors 100 of the second packages P02 and 
P12 in response to the failure detection signals. 

The signal processor 200 includes an identification signal generator 250 for generating an identification 
signal which indicates whether or not the second package to which the signal processor 200 belongs is 
active or inactive. This identification signal is supplied to the controller 900. On the other hand, an 
75 identification signal receiver 950 is provided in the controller 900. The identification signal receiver 950 
invalidates the failure detection signal which is received from the inactive package for a predetermined time 
based on the identification signal which is received from the identification signal generator 250. 

In FIG.3, if it is assumed for the sake of convenience that the first and second packages P01 and P02 
of the system-0 are active, the identification signal generator 250 of the signal processor 200 in the second 
20 package P02 of the system-0 outputs an identification signal which indicates that the system-0 packages 
are active. This identification signal is applied to the controller 900. 

The identification signal receiver 950 of the controller 900 receives the identification signal which is 
output from the identification signal generator 250. The identification signal receiver 950 outputs a control 
signal which invalidates the failure detection signal which is output from the inactive package of the system- 
25 1 in this case, and applies this control signal to the selectors 100 of the second packages P02 and P12. 

The selector 100 selects and outputs the input signal from the signal processor 150 of the first package 
P01 of the system-0 in response to the control signal which is received from the identification signal 
receiver 950. In this case, the inactive package of the system-1 is replaced by a new package during the 
predetermined time in which the controller 900 invalidates the failure detection signal which is output from 
30 the inactive package of the system-1 . 

As a result, it is possible to replace the inactive package during the system operation and without 
affecting the operation of the active package. 

Next, a description will be given of the second aspect of the present invention, by referring to FIG.4. In 
FIG. 4, those parts which are the same as those corresponding parts in FIG.3 are designated by the same 
35 reference numerals, and a description thereof will be omitted. In FIG.4, a mount information generator 260 is 
provided in the signal processor 200 of each of the second packages P02 and P12. 

The mount information generator 260 generates mount information which indicates whether or not the 
package to which the mount information generator 260 belongs is mounted to a unit (not shown) such as 
the communication processing unit. This mount information is supplied to the controller 900. 
40 A mount information receiver 960 is provided in the controller 900. This mount information receiver 960 
receives the mount information output from the mount information generator 260, and invalidates the failure 
detection signal which is received from the inactive package for a predetermined time based on a change in 
the mount information which is received from the mount information generator 260. 

In FIG.4, if it is assumed for the sake of convenience that the first and second packages P01 and P02 
45 of the system-0 are active, the second package P12 of the system-1 may be removed and replaced by a 
new package. In this case, the mount information generator 260 of the signal processor 200 in the second 
package P12 of the system-1 outputs the mount information which indicates that the second package P12 
of the system-1 has been removed from the unit. This mount information is applied to the controller 900. 
The mount information receiver 960 of the controller 900 receives the mount information which is output 
50 from the mount information generator 260. The mount information receiver 960 outputs a control signal 
which invalidates the failure detection signal which is output from the inactive second package P12 of the 
system-1 in this case, and applies this control signal to the selectors 100 of the second packages P02 and 
P12. 

The selector 100 selects and outputs the input signal from the signal processor 150 of the first package 
55 P01 of the system-0 in response to the control signal which is received from the mount information receiver 
960. In this case, the inactive package of the System-1 is replaced by a new package during the 
predetermined time in which the controller 900 invalidates the failure detection signal which is output from 
the inactive second package P12 of the system-1. 
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As a result, it is possible to replace the inactive package during the system operation and without 
affecting the operation of the active package. 

Next, a description will be given of a first embodiment of the failure detection system according to the 
present invention, by referring to FIGS.5 and 6. FIG.5 shows the block system of the first embodiment and 
5 FIG.6 shows the circuit construction of a switch processing part shown in FIG.5. In FIGS.5 and 6, those 
parts which are the same as those corresponding parts in FIGS.1 and 2 are designated by the same 
reference numerals, and a description thereof will be omitted. This embodiment employs the first aspect of 
the present invention described above in conjunction with FIG. 3. 

This first embodiment differs from the conventional failure detection system shown in FIG.1 in that this 
w embodiment sends operational information to the switch processing part from each package and the switch 
processing part disregards the failure detection signal which is received from the inactive package. 

It will be assumed for the sake of convenience that in FIG.3, the packages BO and CO of the system-0 
are the active packages. In this case, the signals input from the circuits (not shown) which are mounted on 
the packages BO and B1 of the previous stage are branched and applied to the selector 1 and the alarm 
15 detectors 3 and 4 of the package CO. The alarm detectors 3 and 4 monitor the input signals and output the 
alarms A1 and A2 when a failure is detected. The alarms A1 and A2 are supplied to a switch processing 
part 9'. At the same time, operational information which in this case indicates that the package CO is active 
is applied to the switch processing part 9'. 

Similarly, the signals input from the circuits (not shown) which are mounted on the packages BO and B1 
20 of the previous stage are branched and applied to the selector 7 and the alarm detectors 5 and 6 of the 
package C1 . The alarm detectors 5 and 6 monitor the input signals and output the alarms A3 and A4 when 
a failure is detected. The alarms A3 and A4 are supplied to the switch processing part 9'. At the same time, 
operational information which in this case indicates that the package C1 is inactive is applied to the switch 
processing part 9'. 

25 Table 3 shows the relationship between the state of the alarms A1 through A4 and the state of selection 
in this embodiment for the case where the system-0 package is active. 

Table 3 





State of Alarm 


State of Selection 


A1 


A2 


A3 


A4 




0 


0 


0 


0 


Previous System 




0 


0 


O 


X 


Previous System 


(1) 


0 


0 


X 


0 


Previous System 




0 


0 


X 


X 


Previous System 




0 


X 


0 


0 


System-0 




0 


X 


0 


X 


System-0 




0 


X 


X 


o 


System-0 




0 


X 


X 


X 


System-0 




X 


0 


0 


0 


System-1 




X 


0 


0 


X 


System-1 




X 


0 


X 


0 


System-1 




X 


0 


X 


X 


System-1 




X 


X 


0 


0 






X 


X 


0 


X 






X 


X 


X 


0 






X 


X 


X 


X 





50 

In the case (a) shown in Table 3, none of the alarms A1, A2 and A4 are generated as indicated by "O" 
but the alarm A3 is generated as indicated by "X". In this case, the alarms A1 , A2 and A4 which indicate 
the normal state respectively are signals "0" in FIG.6 which shows the circuit construction of the switch 
processing part 9'. Hence, signals "1" are output from AND circuits 37, 44 and 48. For this reason, signals 
55 "1" are respectively applied to terminals c and d of a selector 49 via OR circuits 39 and 46. In addition, 
signals "0" and "1" are respectively applied to terminals e and f of a selector 50. 

On the other hand, the operational information related to the packages CO and C1 are applied to the 
selectors 49 and 50. Since the packages B0 and CO are active and the packages B1 and C1 are inactive in 
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this case, the alarms A3 and A4 from the inactive packages BO and CO must be disregarded. In other 
words, in the selectors 49 and 50, the input signals to the terminals d and f are disregarded, and the 
selectors 49 and 50 respectively select and output the input signals "1 " and "0" which are applied to the 
terminals c and e. The selectively output signals "1" and "0" from the selectors 49 and 50 are respectively 

5 applied to the terminals a and b of the selector 33. 

Because the signals "1" and "0" are respectively applied to the terminals a and b, the selector 33 
selects and outputs the input T2 from the Table 2. The output signal of the selector 33 is applied to the 
terminal D of the flip-flop circuit 34 and is output from the terminal Q in response to the clock which is 
applied to the terminal C. The signal output from the terminal Q of the flip-flop circuit 34 is fed back to the 

w terminal T2 of the selector 33, which means that the signal output from the terminal Q indicates the 
selection of the immediately previous system. Here, the "immediately previous system" refers to the 
package which is of the same system-0 or system-1 to which a certain package belongs but is located at a 
stage immediately preceding the certain package. The signal output from the terminal Q of the flip-flop 
circuit 34 is applied to the selector 1 of the package CO and the selector 8 of the package C1 shown in 

15 FIG.5. 

The selector 1 of the package CO selects and outputs the input signal from the immediately previous 
system, that is, the input signal from the package B0 in this case, and applies the output signal to the 
processor 2. As a result, because the alarms A3 and A4 from the inactive package C1 are disregarded, it is 
possible to prevent an erroneous operation even if the inactive package C1 is removed for the purpose of 
20 replacement. 

On the other hand, according to the conventional failure detection system, the system-1 is selected if 
the alarms A1, A2 and A4 are not generated as indicated by "O" and the alarm A3 is generated as 
indicated by "X" in the case (3) shown in Table 1. 

In cases where the alarms A1 through A4 assume states other than those described above, the 
25 immediately previous system, the system-0 or the system-1, is selected depending on the states of the 
alarms A1 through A4 shown in Table 3. 

For example, when the output signal of the package B0 is branched and input to the alarm detectors 3 
and 5 of the packages CO and C1, a failure may be detected in one of the alarm detectors 3 and 5 but not 
in the other. Such a case is indicated by a symbol " — " in Table 3 under the column "State of Selection". 
30 Such a case normally does not occur, but the immediately previous system may be selected if it does 
occur. 

In this embodiment, it is possible to similarly cope with the case where the system-0 package is 
replaced during operation of the system-1 package. The relationship between the state of the alarms A1 
through A4 and the state of selection for the case where the system-1 package is active is shown in Table 
35 4. 
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Table 4 





State of Alarm 


State of Selection 


A1 


A2 


A3 


A4 
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o 
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o 


Previous System 




r\ 
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U 


A 


System-0 




r\ 
U 


r\ 
U 


A 


r\ 
U 


System-1 




V 


r\ 
U 


v 
A 


v 
A 
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(1) 


0 


X 
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0 


Previous System 
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X 
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X 


System-0 
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System-1 
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X 


X 


X 
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0 


Previous System 
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X 


System-0 




X 


0 


X 


0 


System-1 




X 


0 


X 


X 






X 


X 


0 


0 


Previous System 




X 


X 


0 


X 


System-0 




X 


X 


X 


0 


System-1 




X 


X 


X 


X 





The operational information may be generated based on various kinds of information. However, in order 

25 to simplify the circuit construction, a control signal which is supplied to a selector 1 of a package DO which 
is provided at a stage immediately subsequent to the package CO may be used as the operational 
information related to the package CO, because the control signal supplied to the selector 1 of the package 
DO indicates which one of the system-0 and system-1 is active. In this case, the the control signal which is 
supplied to the selector 1 of the package DO from another switch processing part 9' provided for the 

30 packages DO and D1 is also supplied as it is to the switch processing part 9' provided for the packages CO 
and C1 if one switch processing part 9' is provided with respect to each stage of the system-0 and system- 
1. But if a single switch processing part 9' is designed to receive the alarms from all of the packages and 
supply the control signals to all of the selectors of the packages, the control signal which is supplied to the 
selector of the package at an ith stage of a system-j may be used as the operational information from the 

35 processor of the package at an (i-1)th stage of the system-j. 

Next, a description will be given of a second embodiment of the failure detection system according to 
the present invention, by referring to FIGS. 7 and 8. FIG. 7 shows the block system of the second 
embodiment, and FIG. 8 shows the effective operation time of a switch processing part of the second 
embodiment. In FIG.7, those parts which are the same as those corresponding parts in FIGS.1 and 5 are 

40 designated by the same reference numerals, and a description thereof will be omitted. 

In the first embodiment, the switch processing part 9' disregards the alarms from the inactive package 
based on the operational information, so as to prevent an erroneous operation of the system when the 
inactive package is replaced by a new package. On the other hand, in the second embodiment, mount 
information is supplied to a switch processing part 9" and the switch processing part 9" disregards the 

45 alarms from the inactive package based on the mount information. 

In FIG.7, the packages CO and C1 are respectively provided with a connector CT which connects to the 
ground level of the unit when the packages CO and C1 are mounted on the unit. This connector CT is 
coupled to the switch processing part 9". If the package CO is removed from the unit, for example, the 
connector CT of the package CO is no longer the ground level. For example, measures may be taken so 

50 that the connector CT assumes a high level of 5 V if the connector CT is disconnected from the unit. This 
potential information from the connector CT is supplied to the switch processing part 9" as the mount 
information. The switch processing part 9" may have the same circuit construction as the switch processing 
part 9' shown in FIG. 6. 

If the system-1 is active and the alarms A1 , A3 and A4 are not generated as indicated by "O" and the 
55 alarm A2 is generated as indicated by "X" in the case (1) shown in Table 4, for example, the alarms A1, A3 
and A4 are "0" and the alarm A2 is "1" in FIG.6. Hence, a signal "1" is output from the AND circuit 44 in 
this case, and signals "0" are output from the AND circuits 37, 38, 41, 45 and 48. Accordingly, signals "0" 
and "1 " are respectively applied to the terminals c and d of the selector 49 via the OR circuits 39 and 46, 
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and signals "0" are applied to the terminals e and f of the selector 50. 

On the other hand, the mount information from the packages CO and C1 are respectively applied to the 
selectors 49 and 50. In this particular case, the packages B1 and C1 are active and the package C1 still 
remains mounted on the unit. Hence, the ground voltage is applied to the selectors 49 and 50. In addition, 

5 because the packages B0 and CO are inactive, the potential of the connector CT changes from the ground 
level to the high level (for example, 5 V) when the inactive package CO is removed from the unit to be 
replaced by a new package. This high-level signal from the inactive package CO is supplied to the selectors 
49 and 50 of the switch processing part 9" as the mount information. 

A counter (not shown) of the switch processing part 9" starts to count from the time when the high-level 

w signal from the package CO is received at the selectors 49 and 50 as indicated by (b1) in FIG. 8, and 
disregards the alarms A1 and A2 from the package CO until a predetermined time elapses. In other words, 
the alarms A1 and A2 are invalidated for the predetermined time. In FIG.8, (a) denotes a time in which the 
alarms are valid, while (b1) and (b2) denote times in which the alarms are invalid. 

Therefore, in this case, the selectors 49 and 50 shown in FIG.6 disregard the input signals to the 

75 terminals c and e during this predetermined time, and select and output the input signals to the terminals d 
and f. In this case, the signals "1 " and "0" are respectively input to the terminals d and f of the selectors 49 
and 50. The output signals of the selectors 49 and 50 are respectively applied to the terminals a and b of 
the selector 33. 

Because the signals "1 " and "0" are respectively input to the terminals a and b of the selector 33, the 
20 selector 33 selects and outputs the input signal to the terminal T2 based on Table 2. The output signal of 
the selector 33 is applied to the terminal D of the flip-flop circuit 34 and is output from the terminal Q in 
response to the clock which is applied to the terminal C. The signal output from the terminal Q of the flip- 
flop circuit 34 is fed back to the terminal T2 of the selector 33, which means that the signal output from the 
terminal Q indicates the selection of the immediately previous system. The signal output from the terminal 
25 Q of the flip-flop circuit 34 is applied to the selector 1 of the package CO and the selector 7 of the package 
C1. 

The selector 7 of the package C1 selects and outputs the input signal from the system-1 based on the 
selection signal which is output from the switch processing part 9'. As a result, because the alarms A1 and 
A2 from the inactive package CO are disregarded for the predetermined time, it is possible to prevent 
30 erroneous operation of the system even when the inactive package CO is removed from the unit. 

On the other hand, the alarms A1 and A2 from the inactive package CO may be disregarded for the 
predetermined time as indicated by (b2) in FIG.8 when the inactive package CO is mounted on the unit to 
replace an old package. The effect of preventing the erroneous operation of the system is similar to that of 
the above described case, except that a counter (not shown) of the switch processing part 9" in this case 
35 starts to count from the time when the signal from the connector CT falls to the ground level. 

Therefore, by invalidating the alarms A1 and A2 from the inactive package CO, it is possible to prevent 
erroneous operation of the system when the inactive package CO is replaced by a new package. 

Further, the present invention is not limited to these embodiment, but various variations and modifica- 
tions may be made without departing from the scope of the present invention. 
40 Reference signs in the claims are intended for better understanding and shall not limit the scope. 

Claims 

1. A failure detection system for detecting a failure of a package in a redundant system having a duplex 
45 package configuration, characterized in that there are provided: 

a first package (P01, P11) including a signal processor (150) for carrying out a predetermined 
signal processing on an input signal to the first package and for outputting an output signal, said first 
package (P01, P11) being provided in each of first and second systems; 

a second package (P02, P12) including a selector (100) for selectively outputting the output signal 
50 of the signal processor (150) of the first package (P01, P11) in one of the first and second systems in 
response to a control signal, a failure detector (300) for detecting a failure in the output signal of the 
signal processor (150) of the first package (P01, P11) in each of the first and second systems and for 
outputting a failure detection signal if the failure is detected, and a signal processor (200) for carrying 
out a predetermined signal processing on the output signal of the selector (100), said second package 
55 (P02, P12) being provided in each of first and second systems; and 

control means (900), coupled to at least the second package (P02, P12) of each of the first and 
second systems, for supplying the control signal to the selector (100) of the second package (P02, 
P12) in each of the first and second systems based on the failure detection signal received from the 
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second package in each of the first and second systems, so that the selector (100) selectively outputs 
the output signal of the signal processor (150) of the first package (P01, P11) in an active one of the 
first and second systems, 

said control means (900) including means (950, 960) for disregarding the failure detection signal 
5 received from the second package (P02, P12) during a predetermined time in response to a 

predetermined signal. 

2. The failure detection system as claimed in claim 1, characterized in that said predetermined signal 
indicates which one of the first and second systems is active. 

w 

3. The failure detection system as claimed in claim 2, characterized in that there is further provided a third 
package (DO, D1) including a selector (100) for selectively outputting an output signal of the signal 
processor (200) of the second package (P02, P12) in one of the first and second systems in response 
to a control signal which indicates an active one of the first and second systems, said third package 

15 (DO, D1) is provided in each of the first and second systems, and the control signal supplied to the 
selector (100) of the third package is used as it is as the predetermined signal. 

4. The failure detection system as claimed in claim 3, characterized in that said control means (900, 950) 
generates the control signal which is supplied to the selector (100) of the third package (DO, D1). 

20 

5. The failure detection system as claimed in claim 1, characterized in that said predetermined signal 
indicates whether or not the second package (P02, P12) of each of the first and second systems is 
mounted on a unit to which the first package (P01, P11) of each of the first and second systems is 
mounted. 

25 

6. The failure detection system as claimed in claim 5, characterized in that the second package (P02, 
P12) includes a connector (CT) which has a predetermined potential when the second package (P02, 
P12) is mounted on the unit, and the potential of the connector (CT) of the second package (P02, P12) 
is used as it is as the predetermined signal. 

30 

7. The failure detection system as claimed in claim 6, characterized in that the predetermined potential is 
a ground potential. 

8. The failure detection system as claimed in any of claims 1 to 7, characterized in that said predeter- 
35 mined time is set so that a disconnection of the second package in an inactive one of the first and 

second systems from a unit on which the first package (P01, P11) of each of the first and second 
systems are mounted causes no erroneous selection at the selector (1 00) of the second package (P02, 
P12) in response to the control signal. 

40 
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FIG. 6 
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